KB968930 fails at installation with Automatic Updates

I recently faced the problem that I could not install KB968930: Update for Windows XP. Installation failed.
This update contains the Windows Management Framework Core.

This installation failure only occurred on a desktop computer, which had Windows XP Sp3 workstation and the Exchange 2007 Management Console installed.

If you face the same problem and you want to install this update with Automatic Updates, you should first remove the Windows XP update KB926139 (English version) or KB926140 (localized installation version).
After a successful uninstall of KB926139, the installation of KB968930 will complete successfully.

I’ve never found out why it is like this, but it works. 🙂

I’ve also found out that you can probably install KB968930 manually, without uninstalling KB926140 first!
You can download KB968930 here: http://support.microsoft.com/kb/968930

0 0 votes
Article Rating
Notify of
Newest Most Voted
Inline Feedbacks
View all comments
Ed Paulette

I got failure to install due to “Access denied”.

Tried uninstall of Powershell 1.0 (KB926139)–was not suffient to correct problem.

Tried manual install (after uninstall of KB926139) — still did not work.

Do not have Exchange.

Still looking for solution.

Matthias Schröder

Check and correct rights for registry key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost”. At my computer with Windows XP Pro SP3 there was no write right and the installation was done after changing this.

Ed Paulette

Thanks will try it next time. Intrestingly, we have had no problem att all installing on a fresh XP SP3 image (without Power Shell 1.0).

These are “lean images” without Office, Adobe products, or SCCM and Forefront clients and so on. Wonder if Forefront or SCCM clients are “tightening up” something that changes access rights.

What exactly do you mean by “correct rights”. Does your key have different rights than it’s parents or did you compare to computer where there was no problem?

Paul Robinson

hi i donknow where to post my question? i didn found any link here is my questions 1) i want to protect my data in the portable hard disk without encryption (‘cos it comsumes much time) how to do that? does any portable application or any method or program available to do that? 2) I can do programs using cacls.exe and change acls of files. but it din’t works when run the same on same files on other computers i can deny access to a file everyone (c:\windows\sytem32\cacls.exe) cmd cacls.exe filename /d everyone or echo y| cacls.exe file_location\file_name /d everyone… Read more »


I’ve also found that Quest software’s Powergui for Windows Powershell leaves some read-only subkeys in the root of HKCR. http://www.quest.com/powershell/powergui.aspx Specifically: HKEY_CLASSES_ROOT\ .ps1 .ps1xml .psc1 .psd .psd1 .psm1 Set the acls on these keys to allow Full Control by your installation / administration account, and the install will complete perfectly. Powergui still works afterwards, too. Which is nice. I figured this out by using sysinternals’ process monitor: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx as follows: 1) Create procmon filter: Include only file /registry / network events from update.exe 2) Set procmon to drop filtered events. 3) Capture with procmon during installation of KB968930 3) Refine… Read more »

Davide Marzucco

I’m not able to install update KB968930 on my XP Pro SP3 too.
I tried every change proposed here, but with no luck…
still searching for a solution! 🙁


Dear Davide, Further to my post above; what’s the result of using process monitor? To repeat, for clarity… Get processmonitor here: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx use as follows: 1) Create procmon filter: Include only file /registry / network events from update.exe 2) Set procmon to drop filtered events. 3) Capture with procmon during installation of KB968930 3) Refine procmon filter to include only results of “ACCESS DENIED”. If this filter reveals nothing useful, you might try expanding the scope a little to include events not only from update.exe – the ACCESS DENIED error is fairly definitive. I’d be surprised and interested to find… Read more »


Hi Paul, There’s not really enough detail to say exactly what’s happening with your systems; but I think it would be worthwhile you reading through these references: http://support.microsoft.com/search/default.aspx?mode=r&qid=4662&query=cacls.exe&spid=global&catalog=LCID%3D1033&1033comm=1&res=20 …and these: http://www.google.co.uk/search?q=sid+for+everyone …to see if the tools you’re using are actually fit for this particular job as far as windows OS’s are concerned. With CACLS you might be able to *damage* the ACLS in such a way that no windows admin accounts except for those on your own system were able to take control and access the files (I emphasise ‘damage’ for a reason – the behavior just described is abnormal… Read more »

Nate J

Unable to uninstall Powershell 1.0

Registry permissions on SvcHost are correct

I still can’t update powershell to version 2.0


Hi Nate,

what’s the result of a process monitor scan?
Plenty of other registry keys can block the installation. (See below for details).



You work in an environment that refuses to troubleshoot using accurate tools, and forces you to depend on guess work? Tell your sysadmin it’ll take a tenth of the time if you use process monitor, that it’s written by one of the brightest guys Microsoft ever persuaded to come in from the cold and if you’re careful it’ll have negligible impact even on a heavily loaded production system. (If you’ve never used PM before, practice on an old XP box somewhere to get the feel of its filters and syntax) If they make you depend on guess work, my best… Read more »


@christian; Thanks for reminding me about the “run from website” option. I’ve never actually used PM in that way.

@Nate; Good luck.

Briant Dunnican

The “rights” solution worked for us as we have a policy in place to remove that right because os a virus that used it several months ago. I would check if you have a AD policy that has remove the right to change the svchost.

Godd luck and thankx for the fix hope I can help in the future.


What I found that works is:
Open RegEdit
Navigate to HKLM/Software/Microsoft/WindowsNT/CurrentVersion/SvcHost
Give yourself write permission the SvcHost
Close Regedit

You can now install the update.


Perfect… it works!!!

You simplify our life 😉


Both simple and effective.
Thank you!


This works still in almost in 2016! Thanks!


This works still in almost in 2018!
Thank you!

Note : Above registry edit fixes the KB968930 / Windows 2003 R2 64bit – PowerShell 2.0 installation issue or Windows Management Framework Core package installation issue (Windows PowerShell 2.0 and WinRM 2.0)


This works for Windows automatic update/KB968930 installation issue as well as manual download/run of WindowsServer2003-KB968930-x64-ENG.exe issue.

Albert Jeremy

Try this solution from Haralambos Mavromatidis by resetting the security permission.
just copy and run:
%windir%\system32\secedit.exe /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /log C:\secedit.log /verbose

This works for me.
More info, visit: http://connect.microsoft.com/PowerShell/feedback/details/527808/windows-management-framework-core-kb968930-installation-failed

smeb procyon

the best and quick solution is:
copy from another server the c:\windows\$NTUNINSTALLKB926139-V2$
then spuninst.exe

good luck

Would love your thoughts, please comment.x